[wp-trac] [WordPress Trac] #10041: like_escape() should escape backslashes too

[WordPress Trac]

#10041: like_escape() should escape backslashes too
--------------------------------------------+-------------------------------
 Reporter:  miau_jp                         |        Owner:          
     Type:  defect (bug)                    |       Status:  reopened
 Priority:  low                             |    Milestone:  3.0     
Component:  Formatting                      |      Version:  2.8     
 Severity:  minor                           |   Resolution:          
 Keywords:  has-patch early has-unit-tests  |  
--------------------------------------------+-------------------------------

Comment(by miqrogroove):

 Here's one way to simplify the issue:

 The 3 precedents for using like_escape() in WordPress all have this
 pattern:

 {{{
 $like = like_escape($var);
 $sql = "SELECT whatever LIKE '%$like%';
 }}}

 So, one way to make that secure is...

 {{{
 //$stringin expected slashed
 function like_escape($stringin) {
   global $wpdb;
   $stringout = stripslashes($stringin);         // Get raw value
   $stringout = addcslashes($stringout, '\\%_'); // Make value like-safe
   $stringout = $wpdb->_real_escape($stringout); // Make value sql-safe
   return $stringout;
 }
 }}}

 Then in places like canonical.php, the call to prepare() would have to be
 removed when implementing like_escape().

-- 
Ticket URL: <http://core.trac.wordpress.org/ticket/10041#comment:15>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software